<html>
<head><meta charset="utf-8"><title>unsoundness in constant mutable borrows · t-compiler/const-eval · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/index.html">t-compiler/const-eval</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html">unsoundness in constant mutable borrows</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="183594829"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183594829" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183594829">(Dec 16 2019 at 21:51)</a>:</h4>
<p>I'm opening this to discuss the existing unsoundness bugs for the <code>const_mut_refs</code> feature</p>



<a name="183594862"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183594862" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183594862">(Dec 16 2019 at 21:51)</a>:</h4>
<p><span class="user-mention" data-user-id="118594">@ecstatic-morse</span> has pointed out this one: <a href="https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=4371a0cf7245a7d235cb2b8809b0bb10" target="_blank" title="https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=4371a0cf7245a7d235cb2b8809b0bb10">https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=4371a0cf7245a7d235cb2b8809b0bb10</a></p>



<a name="183594955"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183594955" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183594955">(Dec 16 2019 at 21:52)</a>:</h4>
<p>I'm working under the assumption that we don't want to expose mutable references as return values for any constant. So that one must definitively be fixed</p>



<a name="183595050"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183595050" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183595050">(Dec 16 2019 at 21:53)</a>:</h4>
<p>However, I was thinking about a case like this:</p>
<div class="codehilite"><pre><span></span><span class="k">const</span><span class="w"> </span><span class="k">fn</span> <span class="nf">foo</span><span class="p">(</span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="kt">i32</span><span class="p">)</span><span class="w"> </span>-&gt;  <span class="kp">&amp;</span><span class="nc">mut</span><span class="w"> </span><span class="kt">i32</span><span class="p">;</span><span class="w"></span>
<span class="k">const</span><span class="w"> </span><span class="k">fn</span> <span class="nf">bar</span><span class="p">(</span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="kt">i32</span><span class="p">)</span><span class="w"> </span>-&gt; <span class="kt">i32</span><span class="p">;</span><span class="w"></span>
<span class="k">const</span><span class="w"> </span><span class="k">fn</span> <span class="nf">baz</span><span class="p">(</span><span class="n">x</span>: <span class="kp">&amp;</span><span class="nc">mut</span><span class="w"> </span><span class="kt">i32</span><span class="w"> </span><span class="p">)</span><span class="w"> </span>-&gt; <span class="kt">i32</span> <span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="n">bar</span><span class="p">(</span><span class="n">foo</span><span class="p">(</span><span class="n">x</span><span class="p">))</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</pre></div>


<p>Is <code>foo</code> disallowed even if it is not used anywhere outside a constant?</p>



<a name="183595156"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183595156" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183595156">(Dec 16 2019 at 21:54)</a>:</h4>
<p>There's also this one which needs to be fixed: <a href="https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=eb1b6c9bb69dfd8ff18d3c2f50fd66cd" target="_blank" title="https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=eb1b6c9bb69dfd8ff18d3c2f50fd66cd">https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=eb1b6c9bb69dfd8ff18d3c2f50fd66cd</a></p>



<a name="183595366"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183595366" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183595366">(Dec 16 2019 at 21:56)</a>:</h4>
<p>First, I want to ask if it's feasible to forbid creating <em>new</em> mutable references in a const-context for now. Instead only allowing them to be passed in as parameters</p>



<a name="183595520"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183595520" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183595520">(Dec 16 2019 at 21:58)</a>:</h4>
<p>That would mean that e.g. </p>
<div class="codehilite"><pre><span></span><span class="k">const</span><span class="w"> </span><span class="k">fn</span> <span class="nf">demux</span><span class="p">(</span><span class="n">a</span>: <span class="kp">&amp;</span><span class="nc">mut</span><span class="w"> </span><span class="kt">i32</span><span class="p">,</span><span class="w"> </span><span class="n">b</span>: <span class="kp">&amp;</span><span class="nc">mut</span><span class="w"> </span><span class="kt">i32</span><span class="p">,</span><span class="w"> </span><span class="n">sel</span>: <span class="kt">bool</span><span class="p">)</span><span class="w"> </span>-&gt; <span class="kp">&amp;</span><span class="nc">mut</span><span class="w"> </span><span class="kt">i32</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="k">if</span><span class="w"> </span><span class="n">sel</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="n">a</span><span class="w"> </span><span class="p">}</span><span class="w"> </span><span class="k">else</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="n">b</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</pre></div>


<p>is allowed as well as the case you mentioned above, but that it can't really be used in a const context. So maybe this is a no-go?</p>



<a name="183595734"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183595734" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183595734">(Dec 16 2019 at 22:00)</a>:</h4>
<p>(I say it can't be used since there would be no way to create <code>a</code> and <code>b</code>)</p>



<a name="183596063"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183596063" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183596063">(Dec 16 2019 at 22:04)</a>:</h4>
<p>My thought is that we want to do a local analysis that prevents a new <code>&amp;mut</code> from "escaping" a function, so you could do</p>
<div class="codehilite"><pre><span></span><span class="k">const</span><span class="w"> </span><span class="k">fn</span> <span class="nf">foo</span><span class="p">(</span><span class="n">a</span>: <span class="kp">&amp;</span><span class="nc">mut</span><span class="w"> </span><span class="kt">i32</span><span class="p">)</span><span class="w"> </span>-&gt; <span class="kp">&amp;</span><span class="nc">mut</span><span class="w"> </span><span class="kt">i32</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="n">a</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</pre></div>



<a name="183596120"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183596120" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183596120">(Dec 16 2019 at 22:05)</a>:</h4>
<p>but not </p>
<div class="codehilite"><pre><span></span><span class="k">const</span><span class="w"> </span><span class="k">fn</span> <span class="nf">foo</span><span class="p">(</span><span class="n">a</span>: <span class="kp">&amp;</span><span class="nc">mut</span><span class="w"> </span><span class="kt">i32</span><span class="p">)</span><span class="w"> </span>-&gt; <span class="kp">&amp;</span><span class="nc">mut</span><span class="w"> </span><span class="kt">i32</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="k">if</span><span class="w"> </span><span class="o">*</span><span class="n">a</span><span class="w"> </span><span class="o">==</span><span class="w"> </span><span class="mi">0</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="n">a</span><span class="w"> </span><span class="p">}</span><span class="w"> </span><span class="k">else</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="mi">4</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</pre></div>



<a name="183596214"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183596214" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183596214">(Dec 16 2019 at 22:06)</a>:</h4>
<p>Oh well I guess <code>&amp;mut 4</code> won't get promoted, so this is impossible</p>



<a name="183596273"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183596273" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183596273">(Dec 16 2019 at 22:06)</a>:</h4>
<p>In that case, the problem is only with <code>const</code> and <code>static</code> initializers, right?</p>



<a name="183596688"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183596688" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183596688">(Dec 16 2019 at 22:13)</a>:</h4>
<p>Shifting gears, we probably want to allow code like:</p>
<div class="codehilite"><pre><span></span><span class="k">const</span><span class="w"> </span><span class="n">X</span>: <span class="nb">Option</span><span class="o">&lt;&amp;</span><span class="k">mut</span><span class="w"> </span><span class="kt">i32</span><span class="o">&gt;</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="nb">None</span><span class="p">;</span><span class="w"></span>
</pre></div>



<a name="183596893"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183596893" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183596893">(Dec 16 2019 at 22:15)</a>:</h4>
<p>This suggests that we want an <code>HasMutPtr</code> qualification (that is related to but distinct from the existing <code>HasInteriorMut</code> qualif).</p>



<a name="183597017"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183597017" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183597017">(Dec 16 2019 at 22:17)</a>:</h4>
<p>We would <em>not</em> need to check for this in the return value of <code>const fn</code>s, since the borrow checker already prevents us from returning a reference to local memory, mutable or otherwise.</p>



<a name="183599542"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183599542" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183599542">(Dec 16 2019 at 22:49)</a>:</h4>
<blockquote>
<p>My thought is that we want to do a local analysis that prevents a new <code>&amp;mut</code> from "escaping" a function</p>
</blockquote>
<p>shouldn't we want to  prevent <code>&amp;mut</code>s to just escape constant contexts?</p>



<a name="183599663"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183599663" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183599663">(Dec 16 2019 at 22:50)</a>:</h4>
<p>A <code>const fn</code> is a const context. The issue will only be with "top-level" const contexts (<code>const</code> and <code>static</code>).</p>



<a name="183599985"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183599985" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183599985">(Dec 16 2019 at 22:55)</a>:</h4>
<p>Since <code>&amp;mut</code>s created in a top-level context are <code>'static</code> and can escape outside of the block.</p>



<a name="183600706"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183600706" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183600706">(Dec 16 2019 at 23:05)</a>:</h4>
<p>so basically we allow returning mutable references unless we are in a <code>const</code> or <code>static</code>.</p>



<a name="183601377"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183601377" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183601377">(Dec 16 2019 at 23:16)</a>:</h4>
<p>Yes. There should be no issues with <code>const fn</code>s. Remember that structs containing mutable references also must be forbidden.</p>



<a name="183601442"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183601442" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183601442">(Dec 16 2019 at 23:17)</a>:</h4>
<blockquote>
<p>Yes. There should be no issues with <code>const fn</code>s. Remember that structs containing mutable references also must be forbidden.</p>
</blockquote>
<p>just to clarify, any type containing a mutable reference must not be exposed via <code>const</code> nor <code>static</code></p>



<a name="183601458"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183601458" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183601458">(Dec 16 2019 at 23:17)</a>:</h4>
<p>Yes.</p>



<a name="183601466"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183601466" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183601466">(Dec 16 2019 at 23:17)</a>:</h4>
<blockquote>
<p>Shifting gears, we probably want to allow code like:</p>
<div class="codehilite"><pre><span></span><span class="k">const</span><span class="w"> </span><span class="n">X</span>: <span class="nb">Option</span><span class="o">&lt;&amp;</span><span class="k">mut</span><span class="w"> </span><span class="kt">i32</span><span class="o">&gt;</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="nb">None</span><span class="p">;</span><span class="w"></span>
</pre></div>


</blockquote>
<p>This remembers me the problem with making <code>Vec::new()</code> const safe.</p>



<a name="183601652"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183601652" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183601652">(Dec 16 2019 at 23:20)</a>:</h4>
<p>The problem there was that values of non-<code>Copy</code> types can already appear at the top-level of a <code>const</code>, and they will be bitwise copied anyway with no safe code.</p>



<a name="183601764"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183601764" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183601764">(Dec 16 2019 at 23:22)</a>:</h4>
<p><code>&amp;mut T</code> is also a non-<code>Copy</code> type, but we would have to forbid it anyways, even if we did not copy the final value of a const wherever it gets used.</p>



<a name="183601789"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183601789" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183601789">(Dec 16 2019 at 23:22)</a>:</h4>
<p>This is (I think) what <span class="user-mention" data-user-id="124288">@oli</span> was referring to when they mentioned that we might need <code>ConstSafe</code> for <code>&amp;mut</code>, not just const heap allocations.</p>



<a name="183601819"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183601819" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183601819">(Dec 16 2019 at 23:23)</a>:</h4>
<p>However, as soon as a <code>&amp;mut</code> appears in the final value of a <code>const</code>, the battle is already lost. You can use it to mutate CTFE allocations even if the reference is never copied.</p>



<a name="183602018"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183602018" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183602018">(Dec 16 2019 at 23:26)</a>:</h4>
<p>So, I think a good start would be to implement a <a href="https://doc.rust-lang.org/nightly/nightly-rustc/rustc/ty/fold/trait.TypeVisitor.html" target="_blank" title="https://doc.rust-lang.org/nightly/nightly-rustc/rustc/ty/fold/trait.TypeVisitor.html"><code>TypeVisitor</code></a> that can find types with a <code>&amp;mut</code>, and use it to forbid certain types from being the final value of a constant.</p>



<a name="183602022"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183602022" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183602022">(Dec 16 2019 at 23:26)</a>:</h4>
<p>(if one does not already exist)</p>



<a name="183602047"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183602047" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183602047">(Dec 16 2019 at 23:26)</a>:</h4>
<p>And separately to fix whatever code allows you to do <code>&amp;mut Cell::new(4)</code>.</p>



<a name="183602064"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183602064" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183602064">(Dec 16 2019 at 23:27)</a>:</h4>
<p>And we can worry about the <code>Qualif</code> part of this later</p>



<a name="183602464"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183602464" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183602464">(Dec 16 2019 at 23:33)</a>:</h4>
<p>Ok I'll start working on this tomorrow :)</p>



<a name="183602496"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183602496" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183602496">(Dec 16 2019 at 23:34)</a>:</h4>
<p><span aria-label="heart" class="emoji emoji-2764" role="img" title="heart">:heart:</span> Thank you! Might wanna check in with <span class="user-mention silent" data-user-id="124288">oli</span> if they're available in case I missed something.</p>



<a name="183602535"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183602535" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183602535">(Dec 16 2019 at 23:34)</a>:</h4>
<blockquote>
<p>This is (I think) what <span class="user-mention silent" data-user-id="124288">oli</span> was referring to when they mentioned that we might need <code>ConstSafe</code> for <code>&amp;mut</code>, not just const heap allocations.</p>
</blockquote>
<p>No, what I mean is that we want to allow some constant values of a type while disallowing other</p>



<a name="183602543"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183602543" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183602543">(Dec 16 2019 at 23:34)</a>:</h4>
<blockquote>
<p><span aria-label="heart" class="emoji emoji-2764" role="img" title="heart">:heart:</span> Thank you! Might wanna check in with <span class="user-mention silent" data-user-id="124288">oli</span> if they're available in case I missed something.</p>
</blockquote>
<p>Heh yeah that's my main reason for waiting :P</p>



<a name="183602565"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183602565" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183602565">(Dec 16 2019 at 23:34)</a>:</h4>
<p>Yeah, you'll need to implement <code>Qualif</code> to get those semantics.</p>



<a name="183602583"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183602583" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183602583">(Dec 16 2019 at 23:35)</a>:</h4>
<p>Which is not too hard, but also not necessary to fix the soundness issue.</p>



<a name="183602598"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183602598" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183602598">(Dec 16 2019 at 23:35)</a>:</h4>
<blockquote>
<p>Which is not too hard, but also not necessary to fix the soundness issue.</p>
</blockquote>
<p>Well even if it's not neccessary I'd like to come back to it later</p>



<a name="183625164"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183625164" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183625164">(Dec 17 2019 at 07:48)</a>:</h4>
<p><code>static FOO: &amp;mut u32 = &amp;mut 9;</code> is actually fine</p>



<a name="183625176"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183625176" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183625176">(Dec 17 2019 at 07:49)</a>:</h4>
<p>It's only constants that are problematic, because they are copied implicitly</p>



<a name="183625308"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183625308" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183625308">(Dec 17 2019 at 07:51)</a>:</h4>
<p>The reason I mentioned <code>ConstSafe</code> is that <code>&amp;&amp;mut u32</code> is fine, but <code>(&amp;str, &amp;mut u32)</code> is not, which is the same as if it were Box</p>



<a name="183625381"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183625381" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183625381">(Dec 17 2019 at 07:53)</a>:</h4>
<p><code>static FOO: Box&lt;u32&gt;</code> is fine, too</p>



<a name="183625564"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183625564" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183625564">(Dec 17 2019 at 07:56)</a>:</h4>
<p>You can't deallocate or mutate a static</p>



<a name="183625582"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183625582" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183625582">(Dec 17 2019 at 07:57)</a>:</h4>
<p><code>static FOO: AtomicBox&lt;u32&gt;</code> is not fine though</p>



<a name="183625653"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183625653" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183625653">(Dec 17 2019 at 07:58)</a>:</h4>
<p>Even though <code>static FOO: AtomicMutRef&lt;u32&gt;</code> could be fine</p>



<a name="183625657"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183625657" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183625657">(Dec 17 2019 at 07:58)</a>:</h4>
<p>Ugh</p>



<a name="183625669"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183625669" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183625669">(Dec 17 2019 at 07:58)</a>:</h4>
<p>So let's start with everything is not fine and grow the set slowly</p>



<a name="183625796"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183625796" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183625796">(Dec 17 2019 at 08:00)</a>:</h4>
<p>I think a marker type will be simpler than a type visitor?</p>



<a name="183625974"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183625974" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183625974">(Dec 17 2019 at 08:03)</a>:</h4>
<p>We should also forbid raw pointers via that marker type, so noone goes around doing <code>const FOO: *mut u32 = &amp;mut 7;</code></p>



<a name="183626050"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183626050" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183626050">(Dec 17 2019 at 08:05)</a>:</h4>
<p>Which... would break <code>Vec::new()</code>, so we need the "no actual pointers" cop out where the marker trait is not checked</p>



<a name="183626056"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183626056" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183626056">(Dec 17 2019 at 08:05)</a>:</h4>
<p>Oh or we figure out a validation based system</p>



<a name="183626067"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183626067" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183626067">(Dec 17 2019 at 08:06)</a>:</h4>
<p>Ha we already have that type visitor <span class="user-mention" data-user-id="118594">@ecstatic-morse</span></p>



<a name="183626115"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183626115" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183626115">(Dec 17 2019 at 08:06)</a>:</h4>
<p>But it also walks the value at the same time</p>



<a name="183626154"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183626154" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183626154">(Dec 17 2019 at 08:07)</a>:</h4>
<p>Hmm.. we should ask <span class="user-mention" data-user-id="120791">@RalfJ</span> if that is an abuse of validation and whether this deserves its own system</p>



<a name="183693395"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183693395" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183693395">(Dec 17 2019 at 21:24)</a>:</h4>
<p>Ah,  we forbid <code>*STATIC = x</code> already.</p>



<a name="183693618"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183693618" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183693618">(Dec 17 2019 at 21:26)</a>:</h4>
<p>Yeah, a marker trait would be better, I wasn't sure if we're still adding new OIBITs</p>



<a name="183693855"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183693855" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183693855">(Dec 17 2019 at 21:30)</a>:</h4>
<p>I think as soon as you allow a mutable reference to be taken during const-eval, you need to forbid ptr-to-int conversions forever. Otherwise there's no way to stop a user from "laundering" the pointer out of const-eval through an integer type. This may already be the plan.</p>



<a name="183693950"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183693950" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183693950">(Dec 17 2019 at 21:30)</a>:</h4>
<p>That's if you want to try to forbid even <code>*mut</code> in the final value, which may not be feasible as you've explained.</p>



<a name="183701112"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183701112" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183701112">(Dec 17 2019 at 22:59)</a>:</h4>
<blockquote>
<p><code>static FOO: AtomicBox&lt;u32&gt;</code> is not fine though</p>
</blockquote>
<p>I think we are already catching interior mutability so that shouldn't be a problem</p>



<a name="183701372"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183701372" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183701372">(Dec 17 2019 at 23:02)</a>:</h4>
<blockquote>
<p>I think as soon as you allow a mutable reference to be taken during const-eval, you need to forbid ptr-to-int conversions forever. Otherwise there's no way to stop a user from "laundering" the pointer out of const-eval through an integer type. This may already be the plan.</p>
</blockquote>
<p>But even then, you can leak a immutable pointer out of const-eval, right?</p>



<a name="183701435"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183701435" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183701435">(Dec 17 2019 at 23:03)</a>:</h4>
<p><span class="user-mention" data-user-id="132916">@Christian Poveda</span> yes but it's UB to write to them unless you got them from a <code>&amp;mut</code></p>



<a name="183701463"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183701463" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183701463">(Dec 17 2019 at 23:04)</a>:</h4>
<p>So we don't have this problem today</p>



<a name="183701503"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183701503" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183701503">(Dec 17 2019 at 23:04)</a>:</h4>
<p>Ohh so the problem here is UB not unsafety</p>



<a name="183701892"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183701892" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183701892">(Dec 17 2019 at 23:08)</a>:</h4>
<p>and it is not UB to produce a mutable reference from an integer</p>



<a name="183701995"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183701995" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183701995">(Dec 17 2019 at 23:09)</a>:</h4>
<p>It depends on the provenance of the value in the integer.</p>



<a name="183702078"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183702078" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183702078">(Dec 17 2019 at 23:10)</a>:</h4>
<p>oh so if it's an integer from an actual reference it is not UB even though it is wrong here</p>



<a name="183702122"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183702122" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Dylan MacKenzie (ecstatic-morse) <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183702122">(Dec 17 2019 at 23:11)</a>:</h4>
<p>These rules haven't been formalized yet, but that's the idea yes.</p>



<a name="183702140"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183702140" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183702140">(Dec 17 2019 at 23:11)</a>:</h4>
<p>hmmm interesting</p>



<a name="183730370"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/183730370" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#183730370">(Dec 18 2019 at 08:49)</a>:</h4>
<blockquote>
<blockquote>
<p><code>static FOO: AtomicBox&lt;u32&gt;</code> is not fine though</p>
</blockquote>
<p>I think we are already catching interior mutability so that shouldn't be a problem</p>
</blockquote>
<p>statics may have interior mutability. so <code>static FOO: AtomicUsize</code> works on stable</p>



<a name="184059031"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184059031" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184059031">(Dec 22 2019 at 15:42)</a>:</h4>
<p>ouch, this looks nasty</p>



<a name="184059090"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184059090" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184059090">(Dec 22 2019 at 15:44)</a>:</h4>
<blockquote>
<p>It depends on the provenance of the value in the integer.</p>
</blockquote>
<p>integers don't actually have provenance though, not if we fully support int-ptr-casts.<br>
I guess we could make them have provenance for CTFE (that's what currently unleash-miri basically does) but I am not sure of that is a good idea.</p>



<a name="184059102"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184059102" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184059102">(Dec 22 2019 at 15:45)</a>:</h4>
<p>I agree this feels very similar to <code>Box</code>/heap-alloc in const -- we can allow anything to happen during the computation, we just have to be careful in what we allow in the final return value.</p>



<a name="184072767"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184072767" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184072767">(Dec 22 2019 at 22:53)</a>:</h4>
<p>So after hearing from <span class="user-mention" data-user-id="120791">@RalfJ</span> and <span class="user-mention" data-user-id="124288">@oli</span> I'll start working on this :P</p>



<a name="184072833"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184072833" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184072833">(Dec 22 2019 at 22:55)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> there is no way to expose the information from int-to-ptr casts to the compiler so we can check if an integer comes from a pointer?</p>



<a name="184072835"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184072835" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184072835">(Dec 22 2019 at 22:55)</a>:</h4>
<p><span class="user-mention" data-user-id="132916">@Christian Poveda</span> an integer cannot come from a pointer in const eval</p>



<a name="184072877"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184072877" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184072877">(Dec 22 2019 at 22:56)</a>:</h4>
<p>oh that's great D:</p>



<a name="184072879"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184072879" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184072879">(Dec 22 2019 at 22:56)</a>:</h4>
<p>:D</p>



<a name="184072881"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184072881" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184072881">(Dec 22 2019 at 22:56)</a>:</h4>
<p>Though you can have integers as addresses of ZSTs</p>



<a name="184072884"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184072884" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184072884">(Dec 22 2019 at 22:56)</a>:</h4>
<p>wait, why?</p>



<a name="184072898"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184072898" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184072898">(Dec 22 2019 at 22:57)</a>:</h4>
<p><code>&amp;*(1 as *const ())</code> is sound</p>



<a name="184072900"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184072900" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184072900">(Dec 22 2019 at 22:57)</a>:</h4>
<p>it's a valid address for a <code>()</code></p>



<a name="184072944"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184072944" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184072944">(Dec 22 2019 at 22:58)</a>:</h4>
<p>you can get this on stable by using a union to transmute <code>1usize</code> to <code>&amp;'static ()</code></p>



<a name="184073025"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184073025" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184073025">(Dec 22 2019 at 23:00)</a>:</h4>
<p>I think I'm not seeing the whole picture</p>



<a name="184073086"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184073086" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184073086">(Dec 22 2019 at 23:02)</a>:</h4>
<p>I mean, if any integer can be a valid address for a ZST, how does that affect exposing pointers as integers?</p>



<a name="184073087"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184073087" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184073087">(Dec 22 2019 at 23:02)</a>:</h4>
<p>it doesn't. I don't know why we are talking about exposing pointers as integers.</p>



<a name="184073103"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184073103" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184073103">(Dec 22 2019 at 23:03)</a>:</h4>
<p>Side note: I don't know what <code>provenance</code> means</p>



<a name="184073111"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184073111" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184073111">(Dec 22 2019 at 23:04)</a>:</h4>
<p>Ok, wikipedia cleared this up</p>



<a name="184073152"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184073152" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184073152">(Dec 22 2019 at 23:04)</a>:</h4>
<blockquote>
<p>Side note: I don't know what <code>provenance</code> means</p>
</blockquote>
<p>Oxford: ​the place that something originally came from</p>



<a name="184073153"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184073153" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184073153">(Dec 22 2019 at 23:04)</a>:</h4>
<p>:P</p>



<a name="184073158"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184073158" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184073158">(Dec 22 2019 at 23:05)</a>:</h4>
<blockquote>
<p>and it is not UB to produce a mutable reference from an integer</p>
</blockquote>
<p>I thought we were discussing how to avoid leaking mutable references as integers</p>



<a name="184073167"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184073167" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184073167">(Dec 22 2019 at 23:05)</a>:</h4>
<p>aaah</p>



<a name="184073171"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184073171" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184073171">(Dec 22 2019 at 23:05)</a>:</h4>
<p>or am I getting ahead of it?</p>



<a name="184073205"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184073205" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184073205">(Dec 22 2019 at 23:06)</a>:</h4>
<p>so... this feels unrelated, because we have the same "problem" for immutable references</p>



<a name="184073214"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184073214" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184073214">(Dec 22 2019 at 23:06)</a>:</h4>
<p>sec, grabbing the issue id</p>



<a name="184073231"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184073231" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184073231">(Dec 22 2019 at 23:06)</a>:</h4>
<p><a href="https://github.com/rust-lang/rust/issues/63197" target="_blank" title="https://github.com/rust-lang/rust/issues/63197">https://github.com/rust-lang/rust/issues/63197</a></p>



<a name="184073491"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184073491" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184073491">(Dec 22 2019 at 23:14)</a>:</h4>
<p>yea, so this is entirely orthogonal to the problem at hand <span aria-label="slight smile" class="emoji emoji-1f642" role="img" title="slight smile">:slight_smile:</span></p>



<a name="184073565"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184073565" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184073565">(Dec 22 2019 at 23:17)</a>:</h4>
<blockquote>
<p>I think as soon as you allow a mutable reference to be taken during const-eval, you need to forbid ptr-to-int conversions forever. Otherwise there's no way to stop a user from "laundering" the pointer out of const-eval through an integer type. This may already be the plan.</p>
</blockquote>
<p>we need to forbid this forever anyway, because a) you'd be able to create a pseudorandom number generator that may change its value arbitrarily between compiler runs and b) you'd get different addresses at compile-time than at runtime for the same thing</p>



<a name="184073575"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184073575" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184073575">(Dec 22 2019 at 23:17)</a>:</h4>
<p>I don't see any way that would make it possible for us to have ptr-to-int conversions in const eval without causing a whole lot of (to the best of my knowledge unfixable) problems</p>



<a name="184075468"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184075468" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christian Poveda <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184075468">(Dec 23 2019 at 00:19)</a>:</h4>
<p>damn... so the plan is just forbid mutable references (or types containing mutable references) in <code>const</code> or <code>static</code>s</p>



<a name="184075577"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184075577" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184075577">(Dec 23 2019 at 00:22)</a>:</h4>
<p>just in <code>const</code>s I think</p>



<a name="184091639"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184091639" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184091639">(Dec 23 2019 at 09:03)</a>:</h4>
<blockquote>
<p><span class="user-mention silent" data-user-id="132916">Christian Poveda</span> an integer cannot come from a pointer in const eval</p>
</blockquote>
<p>Hu? We have unions in const-eval...</p>



<a name="184091654"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184091654" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184091654">(Dec 23 2019 at 09:03)</a>:</h4>
<p>or do you mean an integer <em>value</em> cannot come from a ptr? True, but that is a difference in semantics between const and real Rust. I'd rather avoid having to spec <em>two</em> languages.</p>



<a name="184092169"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184092169" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184092169">(Dec 23 2019 at 09:15)</a>:</h4>
<p>FWIW, if we properly forced constants to be <code>Sync</code>, that would already exclude raw pointers and we'd have much fewer problems I think...</p>



<a name="184092445"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184092445" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184092445">(Dec 23 2019 at 09:20)</a>:</h4>
<p>if we need some new type-based scheme for <code>const</code>s anyway, maybe that is also a good opportunity to fix the <code>Sync</code> thing</p>



<a name="184093697"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184093697" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184093697">(Dec 23 2019 at 09:48)</a>:</h4>
<p>I don't see how we can ever make an int-to-ptr conversion (<code>force_bits</code>) legal in const eval without bricking everything. So we have <code>static A: i32 = 42;</code> and <code>static B: usize = (&amp;A as *const i32 as usize) / 2 * 2;</code>. If we compute this integer address at const eval time, it is essentially guaranteed, that llvm will produce a different value. I don't see any way to get this to work. So if you then do <code>*(B as *const i32)</code> at runtime, you'll get a segfault or at least a different value than what is stored in <code>A</code></p>



<a name="184093810"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184093810" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184093810">(Dec 23 2019 at 09:50)</a>:</h4>
<p>Also it's not much of a semantics difference. Compile time evaluation will always abort $somewhere where runtime can go on just fine</p>



<a name="184093819"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184093819" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184093819">(Dec 23 2019 at 09:50)</a>:</h4>
<p>it's not like behaviour changes between runtime and compile time</p>



<a name="184093824"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184093824" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184093824">(Dec 23 2019 at 09:50)</a>:</h4>
<p>it's just that some things abort compilation at compile time</p>



<a name="184093846"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184093846" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184093846">(Dec 23 2019 at 09:51)</a>:</h4>
<p>Just like you'll never be able to do <code>*(1234 as *const i32)</code> at compile-time, even if that address is totally sane at runtime on your target</p>



<a name="184093897"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184093897" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184093897">(Dec 23 2019 at 09:52)</a>:</h4>
<p>or how you'll always be able to take an address of an <code>extern static</code> but never deref that pointer because it points nowhere at compile time</p>



<a name="184098641"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184098641" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184098641">(Dec 23 2019 at 11:31)</a>:</h4>
<blockquote>
<p>I don't see how we can ever make an int-to-ptr conversion (force_bits) legal in const eval without bricking everything. </p>
</blockquote>
<p>ah no, that's not at all what I meant</p>



<a name="184098647"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184098647" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184098647">(Dec 23 2019 at 11:31)</a>:</h4>
<p>but we also shouldnt rely on being able to trace the provenance of an integer IMO</p>



<a name="184098696"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184098696" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184098696">(Dec 23 2019 at 11:32)</a>:</h4>
<p>like, if we ever decide that transmuting ptrs to ints is UB, we should do this consistently between runtime and CTFE</p>



<a name="184098712"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146212-t-compiler/const-eval/topic/unsoundness%20in%20constant%20mutable%20borrows/near/184098712" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146212-t-compiler/const-eval/topic/unsoundness.20in.20constant.20mutable.20borrows.html#184098712">(Dec 23 2019 at 11:32)</a>:</h4>
<p>a CTFE that goes on in "best effort" with pointer values at integer type might well be incompatible with the runtime model we end up with</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>